Porchlight

This policy explains which personal data is processed when you visit this website, why, on what legal basis, and what rights you have. Porchlight is a prototype: you can make a real account, and the households marked Example are fictional. Prototype data may be wiped at any time.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR is:
Zelbel Limited, 69 Great Hampton Street, Birmingham, B18 6EW, United Kingdom
Represented by its director, Michael Zelbel
Email: support@ownward.studio

2. Your account and what you share

When you make an account, we store:

your email address, your first name and your age;
your password, only as a salted hash (PBKDF2): we cannot read it, and we never send it anywhere;
what you share to be matched: what you are (woman, man, non-binary or your own word), who you would like to meet, what you are open to (for example dating, soft swap or same room), where, your lights, boundaries and words, and how people may reach you once a door opens;
your knocks and answers, the standing permissions you give, what your assistant may do, and a short activity log of your household;
if you make an assistant address, a hash of its key (the key itself is shown to you once and not kept).

Who you would like to meet and what you are open to says something about your sex life and sexual orientation. That is special category data (Art. 9 GDPR), and we store it only with your explicit consent, which you give with the tick box when you sign up: “Porchlight may store what I share about my sex life and orientation, to match me. I can delete it any time.” Legal basis: Art. 9 (2) (a) and Art. 6 (1) (a) GDPR; for the account itself, Art. 6 (1) (b) GDPR. You can withdraw your consent by deleting your account.

Who sees what. Signed-out visitors see only the fictional example households. Signed-in people see the lights of real households that are on, with first names, ages and what each person is, but never email addresses. How you can be reached is shown only to people whose door opened with yours, which needs everyone’s yes. Your partners in a couple or group see your household’s lights, knocks and activity.

Where it is kept. In one database table of our host’s cloud (Lovable Cloud, run on Supabase), readable only by the server. You stay signed in through one cookie, pl_session (see section 5).

How long. Until you delete your account. “Delete account” on Your porch removes your login and everything you shared at once; your household’s lights go off. This is a prototype: we may also wipe all data at any time, and we will not keep it longer than the prototype runs.

No email is sent. Porchlight sends no email at all: no confirmation, no newsletter, no password reset.

The assistant address (the MCP server at /mcp) acts for you when it is given your key. Without a key it keeps a private demo session in the server’s memory only, dropped after two hours without use.

3. What this website does not do

This site has no contact form, no newsletter, no comments and no advertising. It does not use social media plugins, advertising networks or tracking by Google. The fonts are stored on this site itself, so loading a page sends nothing to a font service.

4. Hosting and server logs

The site is hosted by Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden (“Lovable”), which delivers it through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you open a page, your browser automatically sends data that the servers need to deliver it and keep it secure: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This data is used to deliver the site, to find faults and to fend off attacks. It is not combined with other data and not used to identify you.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a website that works and is secure. The hosting providers keep these logs only as long as they need them for that purpose under their own retention rules.

5. Cookies, local storage and visitor statistics

These cookies are strictly necessary and are set without asking, as § 25 (2) TDDDG allows:

pl_session, set by this site for 30 days when you sign in, keeps you signed in. It holds a signed token, cannot be read by scripts on the page, and is removed when you sign out.
__cf_bm, set by Cloudflare for 30 minutes, tells real visitors apart from automated bots.
__dpl, set by Lovable for 24 hours, makes sure every page you open comes from the same version of the site.

Your cookie choice is kept in your browser’s local storage under the name porchlight-consent, so we do not have to ask again on every page. While you write a light, the draft is kept there too, under porchlight-light-draft, and removed when the light is on.

If you choose “Accept all” in the cookie banner and our host’s visitor statistics run on this site, they count visits. For each page you view they record the page address, the page you came from, your browser’s identification string, your browser language, an approximate country derived from your time zone, and a random session number, which may be stored in a cookie named session-id for 30 minutes so that several page views count as one visit. We see only totals, such as visitors per day and the most read pages. When we last checked, no statistics script loaded and no session-id cookie was set on this site, even after “Accept all”.

Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. If you choose “Just the essentials”, or make no choice, the statistics script is held back: it may neither set its cookie nor send anything. You can withdraw your consent at any time with “Cookie settings” at the bottom of every page. Withdrawal is effective for the future and deletes the session-id cookie immediately. The full list, with lifetimes, is in the cookie policy.

6. Transfers outside the EU and UK

Cloudflare, and some of the providers Lovable relies on, may process data in the USA. Such transfers take place on the basis of the EU-US Data Privacy Framework (and its UK extension) or the European Commission’s standard contractual clauses.

7. Your rights

You have the right to:

ask what personal data we hold about you (Art. 15 GDPR)
have incorrect data corrected (Art. 16 GDPR)
have your data deleted (Art. 17 GDPR)
have processing restricted (Art. 18 GDPR)
receive your data in a portable format (Art. 20 GDPR)
object at any time to processing based on our legitimate interest, for reasons arising from your particular situation (Art. 21 GDPR)
withdraw a consent you gave, with effect for the future (Art. 7 (3) GDPR)
complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. In the UK this is the Information Commissioner’s Office (ico.org.uk).

To use any of these rights, write to support@ownward.studio.

8. No obligation, no automated decisions

You are not obliged to provide any personal data: you can walk down the street without an account, and use everything with statistics declined. Matching is automatic, in that the street shows you only lights that fit both ways, but it decides nothing about you: every door opens only with every person’s own yes.

9. Changes to this policy

We update this policy when the website or the law changes. The date at the top shows the current version.

Privacy policy